[Safe Outputs Conformance] USE-003: upload_artifact.cjs missing 🎭 Staged Mode preview summary

[github-actions]

Conformance Check Failure

Check ID: USE-003
Severity: LOW
Category: Usability

Problem Description

upload_artifact.cjs reads the GH_AW_SAFE_OUTPUTS_STAGED environment variable and sets isStaged = true when dry-run mode is active, but it never emits a 🎭 Staged Mode: Upload Artifact Preview summary to the GitHub Actions job summary. Every other staged-mode handler (e.g., create_pull_request.cjs, noop.cjs, close_entity_helpers.cjs) outputs a rich preview so users can verify what would happen before running in live mode. The upload handler silently skips the upload with no feedback.

Affected Components

• File: actions/setup/js/upload_artifact.cjs
• Line: 457 (isStaged is set but never used to emit a preview)

Current vs Expected Behavior

Current Behavior

// upload_artifact.cjs:457
const isStaged = config["staged"] === true || process.env.GH_AW_SAFE_OUTPUTS_STAGED === "true";
// ... isStaged is checked on line 538 to skip the actual upload,
// but no summary/preview is written to core.summary

When isStaged is true, the handler silently skips the upload — the user sees nothing in the job summary.

Expected Behavior

Following the pattern in create_pull_request.cjs:492:

if (isStaged) {
  let summaryContent = `## 🎭 Staged Mode: Upload Artifact Preview\n\n`;
  summaryContent += `Artifact **\$\{artifactName}** would be uploaded with the following files:\n\n`;
  for (const f of files) {
    summaryContent += `- \`\$\{f}\`\n`;
  }
  summaryContent += `\n_Upload skipped in staged mode._\n`;
  await core.summary.addRaw(summaryContent).write();
}

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

1. Locate the isStaged branch in upload_artifact.cjs (around line 538 where !isStaged guards the actual upload).
2. Add an else (or a separate if (isStaged)) block that writes a ## 🎭 Staged Mode: Upload Artifact Preview summary using core.summary.addRaw(...).write().
3. The preview should list the artifact name, the files that would be uploaded, and a note that the upload was skipped.
4. Add or update a unit test in upload_artifact.test.cjs (if it exists) to assert that the staged-mode summary contains "🎭 Staged Mode".

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The check USE-003 should pass without errors.

References

• Safe Outputs Specification: docs/src/content/docs/reference/safe-outputs-specification.md
• Reference implementation: actions/setup/js/create_pull_request.cjs:492
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Run ID: §24425263907
• Date: 2026-04-14

Generated by Daily Safe Outputs Conformance Checker · ● 115K · ◷

• expires on Apr 15, 2026, 10:10 PM UTC